An information security policy must be: